CVE-2026-74709: Linux Kernel Privilege Escalation Vulnerability

CVE-2026-74709 Overview

CVE-2026-74709 is a Linux kernel vulnerability in the AF_XDP socket (xsk) zero-copy transmit path. User space can modify metadata flags after the kernel has already processed a transmit request. When completion handling re-reads those flags, the kernel may write a timestamp into memory that was never intended to receive one.

The issue affects packet completion processing when XDP_TXMD_FLAGS_TIMESTAMP handling relies on rereading user-controlled fields. The mlx5 multi-packet Work Queue Entry (WQE) path is specifically noted because metadata is evaluated per batch rather than per descriptor.

Critical Impact
A local user with access to an AF_XDP socket can cause the kernel to write timestamp data into metadata regions that were not marked for timestamping, producing inconsistent or unintended writes inside the metadata area.

Affected Products

Linux kernel AF_XDP (xsk) subsystem
mlx5 driver multi-packet WQE transmit path
Zero-copy XDP transmit paths that reread metadata flags at completion

Discovery Timeline

2026-08-22 - CVE-2026-74709 published to the National Vulnerability Database (NVD)
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74709

Vulnerability Analysis

The vulnerability is a Time-of-Check Time-of-Use (TOCTOU) race condition in the AF_XDP transmit and completion path. During request processing, the kernel reads XDP_TXMD_FLAGS_TIMESTAMP from a user-space descriptor. During completion, the kernel rereads the same flag field to decide whether to write a timestamp back into the metadata area.

Because the metadata region is shared with user space, a user process can flip flag bits between submission and completion. The kernel then performs a write that was not authorized when the packet was originally submitted. The fix clears the metadata pointer during request processing unless timestamp completion was requested, and completion handling uses that pointer instead of rereading flags.

Root Cause

The root cause is unsafe reuse of user-controlled flag data across two kernel stages. The submission stage validated the timestamp request, but the completion stage repeated the read from shared memory instead of relying on kernel-owned state. This double-read pattern is the classic precondition for a TOCTOU flaw.

Attack Vector

Exploitation requires local access and the ability to create an AF_XDP socket with a zero-copy transmit ring. On the mlx5 multi-packet WQE path the impact is broader: xsk_tx_metadata_request() runs only for the descriptor that starts a session, so only that descriptor's pointer is reset. Completion handling can then record a timestamp for other descriptors in the same session regardless of their own XDP_TXMD_FLAGS_TIMESTAMP bit. The write is bounded to the metadata area; single-WQE, other zero-copy, and generic paths reset the pointer per descriptor and are not affected.

No verified public exploit code is available. See the upstream commits for technical details: Kernel Git Commit 0ba2e1e, Kernel Git Commit 9f60a67, and Kernel Git Commit eb4c613.

Detection Methods for CVE-2026-74709

Indicators of Compromise

Unexpected timestamp values written into AF_XDP completion metadata for descriptors that did not set XDP_TXMD_FLAGS_TIMESTAMP.
Processes opening AF_XDP sockets with zero-copy bind flags on mlx5 interfaces on unpatched kernels.
Application-level errors from AF_XDP consumers that parse metadata assuming timestamp presence follows the submitted flag.

Detection Strategies

Inventory running kernel versions against the fixed commits and flag hosts running unpatched mainline or stable kernels with mlx5 hardware.
Audit workloads that use AF_XDP zero-copy transmit (DPDK-like userspace network stacks, high-throughput packet processors) for exposure.
Monitor bpf() and socket(AF_XDP, ...) syscall usage on hosts where unprivileged AF_XDP is enabled.

Monitoring Recommendations

Collect kernel build and version telemetry from Linux endpoints and servers to identify unpatched systems at scale.
Log creation of AF_XDP sockets and correlate with process identity to establish a baseline of legitimate users.
Alert on kernel warnings or KASAN reports referencing xsk_tx_metadata functions during runtime testing.

How to Mitigate CVE-2026-74709

Immediate Actions Required

Update affected Linux kernels to a stable release containing commits 0ba2e1e, 9f60a67, and eb4c613.
Restrict AF_XDP socket creation to trusted users by keeping CAP_NET_RAW and CAP_BPF limited on multi-tenant hosts.
On mlx5-backed systems that cannot patch immediately, avoid the multi-packet WQE transmit path in production workloads.

Patch Information

The upstream fix clears the metadata pointer during request processing unless a timestamp completion was requested. Completion handling then dereferences the kernel-owned pointer instead of rereading user-controlled flags. Apply the fix from Kernel Git Commit 0ba2e1e, Kernel Git Commit 9f60a67, or Kernel Git Commit eb4c613 as backported by your distribution.

Workarounds

Disable unprivileged AF_XDP by ensuring sysctl kernel.unprivileged_bpf_disabled=1 where policy allows.
Constrain container and pod capabilities so untrusted workloads cannot create AF_XDP sockets on host network devices.
Prefer generic or single-WQE transmit paths over the mlx5 multi-packet WQE path until patches are deployed.

bash

# Verify kernel version and confirm the fix is present in your build
uname -r
grep -E 'xsk_tx_metadata|0ba2e1eb07a8|9f60a67df8d3|eb4c613d4ebc' /proc/kallsyms 2>/dev/null || echo 'symbols not exposed'

# Reduce exposure on multi-tenant hosts
sysctl -w kernel.unprivileged_bpf_disabled=1